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Foreword 



This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under www.etsi.org/kev ■ 

The 3GPP Confidentiality and Integrity Algorithms f8 & f9 have been developed through the collaborative efforts of the 
European Telecommunications Standards Institute (ETSI), the Association of Radio Industries and Businesses (ARIB), 
the Telecommunications Technology Association (TTA), the Tl Committee. 

The f8 & f9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must get a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

For details of licensing procedures, contact ETSI, ARIB, TTA or Tl. 



The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



This specification has been prepared by the 3GPP Task Force, and gives a detailed specification of the 3GPP Algorithm 
KASUMI. KASUMI is a block cipher that forms the heart of the 3GPP confidentiality algorithm/*, and the 3GPP 
integrity algorithm /9. 

This document is the second of four, which between them form the entire specification of the 3GPP Confidentiality and 
Integrity Algorithms: 

3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 1: /8 and 
f9 Specification". 

- 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services and 
System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; 
Document 2: KASUMI Specification". 
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3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 3: 
Implementors' Test Data". 

3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 4: Design 
Conformance Test Data". 

The normative part of the specification of KASUMI is in the main body of this document. The annexes to this 
document are purely informative. Annex 1 contains illustrations of functional elements of the algorithm, while Annex 2 
contains an implementation program listing of the cryptographic algorithm specified in the main body of this document, 
written in the programming language C. 

Similarly the normative part of the specification of the /S (confidentiality) and the/? (integrity) algorithms is in the 
main body of Document 1 . The annexes of those documents, and Documents 3 and 4 above, are purely informative. 
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Scope 



This specification gives a detailed specification of the 3GPP Algorithm KASUMI. KASUMI is a block cipher that 
forms the heart of the 3GPP confidentiality algorithm _/S, and the 3GPP integrity algorithm/?. 
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NORMATIVE SECTION 

This part of the document contains the normative specification of the KASUMI algorithm. 
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1 Outline of the normative part 

Section 2 introduces the algorithm and describes the notation used in the subsequent sections. 
Section 3 defines the algorithm structure and its operation. 
Section 4 defines the basic components of the algorithm. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 version 3.2.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 version 3.1.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 1: f8 and f9 Specification". 

[4] 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 2: KASUMI Specification". 

[5] 3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 3: Implementors' Test Data". 

[6] 3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 4: Design Conformance Test Data". 

[7] ISO/IEC 9797-1 : 1999: "Information technology - Security techniques - Message Authentication 

Codes (MACs)". 



Introductory information 



2.1 Introduction 

Within the security architecture of the 3GPP system there are two standardised algorithms: A confidentiality algorithm 
f8, and an integrity algorithm /?. These algorithms are fully specified in a companion document[3]. Each of these 
algorithms is based on the KASUMI algorithm that is specified here. 

KASUMI is a block cipher that produces a 64-bit output from a 64-bit input under the control of a 128-bit key. 
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2.2 Notation 

2.2.1 Radix 

We use the prefix Ox to indicate hexadecimal numbers. 

2.2.2 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of sub-strings, the 
left most (most significant) sub-string consists of the most significant part of the original string and so on through to the 
least significant. 

For example if a 64-bit value X is subdivided into four 16-bit substrings P, Q, R, S we have: 

X = 0x01 23456789 ABCDEF 

we have: 

P = 0x0123, Q = 0x4567, R = Ox89AB, S = OxCDEF. 

In binary this would be: 

X = 000000010010001 10100010101 1001 1 1 10001001 1010101 1 1 1001 101 1 1 101 1 1 1 

with P = 0000000 1 00 1 000 1 1 

2 = 0100010101100111 

R= 1000100110101011 
S= 1100110111101111 

2.2.3 Conventions 

We use the assignment operator '=', as used in several programming languages. When we write 

<variable> = <expression> 
we mean that <variable> assumes the value that <expression> had before the assignment took place. For instance, 

x = X + y + 3 
means 

(new value of x) becomes (old value of x) + (old value of y) h- 3. 

2.2.4 Subfunctions 

KASUMI decomposes into a number of subfunctions {FL, FO, FT) which are used in conjunction with associated sub- 
keys {KL, KO, KT) in a Feistel structure comprising a number of rounds (and rounds within rounds for some 
subfunctions). Specific instances of the function and/or keys are represented by XXjj where i is the outer round number 
of KASUMI and J is the inner round number. 

For example the function FO comprises three rounds of the function FI, so we designate the third round of FI in the 
fifth round of KASUMI as FIs3- 
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2.2.5 List of Symbols 



= The assignment operator. 

© The bitwise exclusive-OR operation. 

II The concatenation of the two operands. 

«<n The left circular rotation of the operand by n bits. 

ROL( ) The left circular rotation of the operand by one bit. 

n The bitwise AND operation. 

u The bitwise OR operation. 



2.3 List of Functions and Variables 

/( ) The round function for the i* round of KASUMI 

FI() A subfunction within KASUMI that translates a 16-bit input to a 16-bit output using a 16-bit 

subkey. 

FL() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using a 32-bit 

subkey. 

FO() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using two 48-bit 

subkey s. 

K A 128-bit key. 

KL„KOi,KIi subkeys used within the i* round of KASUMI. 



S7[] 
S9[] 



An S-Box translating a 7-bit input to a 7-bit output. 
An S-Box translating a 9-bit input to a 9-bit output. 



KASUMI operation 



3.1 



Introduction 



(See figure 1 in Annex 1) 

KASUMI is a Feistel cipher with eight rounds. It operates on a 64-bit data block and uses a 128-bit key. In this section 
we define the basic eight-round operation. In section 4 we define in detail the make-up of the round function/;( ). 
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3.2 Encryption 

KASUMI operates on a 64-bit input / using a 128-bit key K to produce a 64-bit output OUTPUT, as follows: 

The input / is divided into two 32-bit strings Lo and Ro, where 

I = Lo II Ro 

Then for each integer i with 1 < / < 8 we define: 

Ri = Li.i, Li = Ri.iefi(Li.i,RKi) 

This constitutes the i* round function of KASUMI, where /J- denotes the round function with Lt.j and round key 
RKi as inputs (see section 4 below). 

The result OUTPUT is equal to the 64-bit string (Lg II Rg) offered at the end of the eighth round. See figure 1 of 
Annex 1. 

In the specifications for the/5 and/9 functions we represent this transformation by the term: 

OUTPUT = KASUMI[ / ]k 



Components of KASUMI 



4.1 Function f, 

(See figure 1 in Annex 1) 

The function/( ) takes a 32-bit input / and returns a 32-bit output O under the control of a round key RKi, where the 
round key comprises the subkey triplet of (KLi, KOi, Kit). The function itself is constructed from two subfunctions; FL 
and FO with associated subkeys KLi (used with FL) and subkeys KOi and KIi (used with FO). 

The/( ) function has two different forms depending on whether it is an even round or an odd round. 

For rounds 1,3,5 and 7 we define: 

fi(I,RKi) = FO( FL( I, KLi), KOi, KIj ) 
and for rounds 2,4,6 and 8 we define: 

fi(I,Ki) = FL( FO( I, KOi, Kli ), KLi ) 

i.e. For odd rounds the round data is passed through FL{ ) and then FO{ ), whilst for even rounds it is passed through 
FO( ) and then fL(). 

4.2 Function FL 

(See figure 4 in Annex 1) 

The input to the function FL comprises a 32-bit data input / and a 32-bit subkey KLi. The subkey is split into two 16- 
bit subkeys, KLij and KLi2 where 

KLi = KLi,illKLi,2. 

The input data / is split into two 16-bit halves, L and R where I = L W R. 

We define: 

R' = R®ROL{Lr\ KLi,i) 
L' = L@ROL{R'Kj KLi2) 

The 32-bit output value k{L'\\R'). 
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4.3 Function FO 

(See figure 2 in Annex 1) 

The input to the function FO comprises a 32-bit data input / and two sets of subkeys, a 48-bit subkey KOj and 48-bit 
subkey KIi. 

The 32-bit data input is split into two halves, Lq and Rq where I = LgW Rq. 

The 48-bit subkeys are subdivided into three 16-bit subkeys where 

KOi = KOii II KOi,2 II KOi,3 and KI; = KIji II KIi,2 II Klja. 

Then for each integerj with 1 <j < 3 we define: 

Rj = FI(Lj., ® KOij , KIij ) e Rj.j 

Finally we return the 32-bit value (L3 II R3). 

4.4 Function Fl 

(See figure 3 in Annex 1 . The thick and thin lines in this diagram are used to emphasise the difference between the 
9-bit and 7-bit data paths respectively). 

The function FI takes a 16-bit data input / and 16-bit subkey KIij. The input / is split into two unequal components, a 
9-bit left half Lo and a 7-bit right half /?o where I = Lo\\Ro- 

Similarly the key KIij is split into a 7-bit component KIij] and a 9-bit component KIij2 where KIij = KIjjj II KIij2- 

The function uses two S-boxes, S7 which maps a 7-bit input to a 7-bit output, and S9 which maps a 9-bit input to a 9-bit 
output. These are fully defined in section 4.5. It also uses two additional functions which we designate ZE{ ) and TR{ ). 
We define these as: 

ZE{ X ) takes the 7-bit value x and converts it to a 9-bit value by adding two zero bits to the most-significant end. 

TR{ X ) takes the 9-bit value x and converts it to a 7-bit value by discarding the two most-significant bits. 

We define the following series of operations: 

Li = Ro Ri = S9[Lo]®ZEiRo) 

L2 = Ri® KIij2 R2 = S7[Lj] ® TRiRi) ® KIijj 

L3 = R2 R3 = S9[L2]®ZEiR2) 

L, = S7[L3]®TR{R3) R, = R3 
The function returns the 16-bit value {L4 II R4). 
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4.5 S-boxes 

The two S-boxes have been designed so that they may be easily implemented in combinational logic as well as by a 
look-up table. Both forms are given for each table. 

The input AC comprises either seven or nine bits with a corresponding number of bits in the output _y. We therefore have: 

X =x8 \\x7 \\x6\\x5 \\x4\\x3 \\x2 Wxl WxO 
and 

y =y8 \\y7 \\y6 \\y5 \\y4 \\y3 \\y2 Wyl WyO 

where the x8, y8 and x7,y7 bits only apply to S9, and the xO and yO bits are the least significant bits. 

In the logic equations: 

x0xlx2 implies xO n xl n x2 where n is the AND operator. 
® is the exclusive-OR operator. 

Following the presentation of the logic equations and the equivalent look-up table an example is given of the use of 
each. 

4.5.1 S7 

Gate Logic : 

yO =xlx3©x4©x0xlx4©x5®x2x5®x3x4x5©x6©x0x6©xlx6®x3x6©x2x4x6©xlx5x6 

©x4x5x6 
yl =x0xl©x0x4©x2x4©x5ffixlx2x5ffix0x3x5©x6ffix0x2x6©x3x6©x4x5x6ffil 
y2 =x0©x0x3ffix2x3©xlx2x4ffix0x3x4ffixlx5©x0x2x5ffix0x6®x0xlx6®x2x6©x4x6©l 
y3 =xl©x0xlx2ffixlx4©x3x4©x0x5©x0xlx5©x2x3x5ffixlx4x5ffix2x6©xlx3x6 
y4 =x0x2©x3ffixlx3©xlx4©x0xlx4©x2x3x4©x0x5®xlx3x5©x0x4x5©xlx6®x3x6 

©x0x3x6©x5x6©l 
y5 =x2©x0x2©x0x3©xlx2x3©x0x2x4©x0x5©x2x5©x4x5©xlx6©xlx2x6ffix0x3x6 

®x3x4x6©x2x5x6©l 
y6 =xlx2©x0xlx3©x0x4©xlx5©x3x5©x6©x0xlx6©x2x3x6©xlx4x6©x0x5x6 

Decimal Table : 

54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18,123, 33 

55,113, 39,114, 21, 67, 65, 12, 47, 73, 46, 27, 25,111,124, 81 

53, 9,121, 79, 52, 60, 58, 48,101,127, 40,120,104, 70, 71, 43 

20,122, 72, 61, 23,109, 13,100, 77, 1, 16, 7, 82, 10,105, 98 

117,116, 76, 11, 89,106, 0,125,118, 99, 86, 69, 30, 57,126, 87 

112, 51, 17, 5, 95, 14, 90, 84, 91, 8, 35,103, 32, 97, 28, 66 

102, 31, 26, 45, 75, 4, 85, 92, 37, 74, 80, 49, 68, 29,115, 44 

64,107,108, 24,110, 83, 36, 78, 42, 19, 15, 41, 88,119, 59, 3 

Example: 

If we have an input value = 38, then using the decimal table S7[38] = 58. 
For the combinational logic we have: 

38 = 01001 IO2 ^ x6 = 0, x5=l, x4=0, x3=0, x2=l, xl=l, xO=0 
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which gives us: 



yo = oeoeoe i e i eoeoeoeoeoeoeoeo 
y 1 = oeoeoe i e i eoeoeoeoeoe i = i 

y2 = oeoeoeoeoe i eoeoeoeoeoe i = o 
y3 = leoeoeoeoeoeoeoeoeo = i 

y4 = oeoeoeoeoeoeoeoeoeoeoeoeoei = i 
y5 = 1 eoeoeoeoeoe ieoeoeoeoeoeoei= i 
y6 = 1 eoeoe i eoeoeoeoeoeo = o 



Thus y = 01 110102 = 58 



4.5.2 S9 



Gate Logic : 



yO = X0x2®x3©x2x5©x5x6©x0x7©xlx7®x2x7©x4x8®x5x8©x7x8©l 

yl = Xl®x0xl©x2x3®x0x4©xlx4©x0x5®x3x5©x6®xlx7©x2x7©x5x8®l 

y2 = Xl®x0x3©x3x4®x0x5©x2x6©x3x6®x5x6©x4x7®x5x7©x6x7©x8®x0x8©l 

y3 = X0®xlx2©x0x3ffix2x4©x5©x0x6ffixlx6©x4x7ffix0x8©xlx8©x7x8 

y4 = X0xl®xlx3©x4ffix0x5©x3x6©x0x7®x6x7©xlx8®x2x8©x3x8 

y5 = X2®xlx4©x4x5©x0x6ffixlx6ffix3x7®x4x7©x6x7®x5x8ffix6x8©x7x8®l 

y6 = X0®x2x3©xlx5ffix2x5©x4x5©x3x6®x4x6©x5x6®x7©xlx8©x3x8®x5x8©x7x£ 

y7 = X0xl®x0x2©xlx2®x3©x0x3©x2x3®x4x5©x2x6®x3x6©x2x7©x5x7®x8©l 

y8 = X0xl®x2©xlx2®x3x4©xlx5©x2x5®xlx6©x4x6®x7©x2x8©x3x8 

Decimal Table : 



167,239 


161 


379 


391 


334 


9,338 


38,226 


48 


358 


452 


385 


90,397 


183,253 


147 


331 


415 


340 


51,362 


306,500 


262 


82 


216 


159 


356,177 


175,241 


489 


37 


206 


17 


0,333 


44,254 


378 


58 


143 


220 


81,400 


95, 3 


315 


245 


54 


235 


218,405 


472,264 


172 


494 


371 


290 


399, 76 


165, 197 


395 


121 


257 


480 


423,212 


240, 28 


462 


176 


406 


507 


288,223 


501,407 


249 


265 


89 


186 


221,428 


164, 74 


440 


196 


458 


421 


350, 163 


232,158 


134 


354 


13 


250 


491,142 


191, 69 


193 


425 


152 


227 


366,135 


344,300 


276 


242 


437 


320 


113,278 


11,243 


87 


317 


36 


93 


496, 27 


487,446 


482 


41 


68 


156 


457,131 


326,403 


339 


20 


39 


115 


442,124 


475,384 


508 


53 


112 


170 


479,151 


126,169 


73 


268 


279 


321 


168,364 


363,292 


46 


499 


393 


327 


324, 24 


456,267 


157 


460 


488 


426 


309,229 


439,506 


208 


271 


349 


401 


434,236 


16,209 


359 


52 


56 


120 


199,277 


465,416 


252 


287 


246 


6 


83,305 


420,345 


153 


502 


65 


61 


244,282 


173,222 


418 


67 


386 


368 


261,101 


476,291 


195 


430 


49 


79 


166,330 


280,383 


373 


128 


382 


408 


155,495 


367,388 


274 


107 


459 


417 


62,454 


132,225 


203 


316 


234 


14 


301, 91 


503,286 


424 


211 


347 


307 


140,374 


35,103 


125 


427 


19 


214 


453,146 


498,314 


444 


230 


256 


329 


198,285 


50,116 


78 


410 


10 


205 


510,171 


231, 45 


139 


467 


29 


86 


505, 32 


72, 26 


342 


150 


313 


490 


431,238 


411,325 


149 


473 


40 


119 


174,355 


185,233 


389 


71 


448 


273 


372, 55 


110, 178 


322 


12 


469 


392 


369, 190 


1, 109 


375 


137 


181 


88 


75,308 


260,484 


98 


272 


370 


275 


412, 111 


336,318 


4 


504 


492 


259 


304, 77 


337,435 


21 


357 


303 


332 


483, 18 


47, 85 


25 


497 


474 


289 


100,269 


296,478 


270 


106 


31 


104 


433, 84 


414,486 


394 


96 


99 


154 


511,148 


413,361 


409 


255 


162 


215 


302,201 


266,351 


343 


144 


441 


365 


108,298 


251, 34 


182 


509 


138 


210 


335,133 


311,352 


328 


141 


396 


346 


123,319 


450,281 


429 


228 


443 


481 


92,404 


485,422 


248 


297 


23 


213 


130,466 


22,217 


283 


70 


294 


360 


419,127 


312,377 


7 


468 


194 


2 


117,295 


463,258 


224 


447 


247 


187 


80,398 


284,353 


105 


390 


299 


471 


470, 184 


57,200 


348 


63 


204 


188 


33,451 


97, 30 


310 


219 


94 


160 


129,493 


64, 179 


263 


102 


189 


207 


114,402 


438,477 


387 


122 


192 


42 


381, 5 


145, 118 


180 


449 


293 


323 


136,380 


43, 66 


60 


455 


341 


445 


202,432 


8,237 


15 


376 


436 


464 


59,461 
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Example: 

If we have an input value = 138, then using the decimal table S9[138] = 339. 
For the combinational logic we have: 

138 = 0100010102 ^ x8 = 0, x7= l,x6 = 0, x5=0, x4=0, x3=l,x2=0, xl=l,xO=0 
which gives us: 

yo = oe 1 eoeoeoe i eoeoeoeoe i = i 

yi = leoeoeoeoeoeoeoeieoeoei = i 

y2 = ieoeoeoeoeoeoeoeoeoeoeoei =o 

y3 = oeoeoeoeoeoeoeoeoeoeo = o 

y4 = oe 1 eoeoeoeoeoeoeoeo = i 

y5 = oeoeoeoeoe i eoeoeoeoeoe i = o 

y6 = oeoeoeoeoeoeoeoe i eoeoeoeo = i 

y7 = oeoeoeieoeoeoeoeoeoeoeoei =o 

y8 = oeoeoeoeoeoeoeoe leoeo = i 

Thus y= 1010100112 = 339 



4.6 Key Schedule 



KASUMI has a 128-bit key K. Each round of KASUMI uses 128 bits of key that are derived from K. Before the round 
keys can be calculated two 16-bit arrays Kj and Kj' (j=\ to 8) are derived in the following manner: 

The 128-bit key K is subdivided into eight 16-bit values K1...K8 where 

K = K1IIK2IIK3II...IIK8. 

A second array of subkeys, Kj' is derived from Kj by applying: 

For each integer j with 1 < j < 8 

Kj'= KjeCj 

Where Cj is the constant value defined in table 2. 

The round subkeys are then derived from Kj and Kj' in the manner defined in table 1 . 

Table 1 : Round subkeys 



KLi,i 
KLi,2 

KOm 
K0i2 
K0i,3 

Kli,i 

Kli,2 
Kli,3 



1 


2 


3 


4 


5 


8 


7 


8 


K1«<1 


K2«<1 


K3«<1 


K4«<1 


K5«<1 


K6«<1 


K7«<1 


K8«<1 


K3' 


K4' 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K2«<5 


K3«<5 


K4«<5 


K5«<5 


K6«<5 


K7«<5 


K8«<5 


K1«<5 


K6«<8 


K7«<8 


K8«<8 


K1«<8 


K2«<8 


K3«<8 


K4«<8 


K5«<8 


K7«<13 


K8«<13 


K1«<13 


K2«<13 


K3«<13 


K4«<13 


K5«<13 


K6«<13 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K3' 


K4' 


K4' 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K3' 


K8' 


K1' 


K2' 


K3' 


K4' 


K5' 


K6' 


K7' 
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Table 2: Constants 



C1 


0x0123 


C2 


0x4567 


C3 


0x89AB 


C4 


OxCDEF 


C5 


OxFEDC 


C6 


0xBA98 


C7 


0x7654 


C8 


0x3210 
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INFORMATIVE SECTION 

This part of the document is purely informative and does not form part of the normative specification of KASUMI. 
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Annex 1 (informative): 

Figures of the KASUIVII Algorithm 






KI; 



i,J,2 



Fig.2: FO Function Fig. 3: FI Function 

32 




I I bitwise AND operation 
I I bitwise OR operation 
<^<^<^ one bit left rotation 



Fig. liKASUMI 



Fig.4: FL Function 
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KASUMI has a number of characteristics that may be exploited in a hardware implementation and these are highlighted 
here. 

The simple key schedule is easy to implement in hardware. 

The S-Boxes have been designed so that they may be implemented by a small amount of combinational logic 
rather than by large look-up tables. 

The S7-Box and S9-Box operations in the FI function may be carried out in parallel (see alternative presentation 
in figure 5). 

The Fli 1 and Fli 2 operations may be carried out in parallel (see alternative presentation in figure 6). 




C>^"— K) 





Fig. 5: FI Function 



Fig. 6: FO Function 
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Annex 2 (informative): 
Simulation Program Listing 

Header file 

/* 

* Kasumi.h 

* */ 

typedef unsigned char u8; 
typedef unsigned short ul6; 
typedef unsigned long u32; 

void KeySchedule ( u8 *key ) ; 
void Kasumi ( u8 *data ) ; 

CCode 

/* 

* Kasumi . c 

* A sample implementation of KASUMI, the core algorithm for the 

* 3GPP Confidentiality and Integrity algorithms. 

* This has been coded for clarity, not necessarily for efficiency. 

* This will compile and run correctly on both Intel (little endian) 

* and Sparc (big endian) machines. (Compilers used supported 32-bit ints) . 

* Version 1.1 08 May 2000 

* */ 

#include "Kasumi.h" 

/* 16 bit rotate left */ 

#define R0L16 (a,b) (ul6) ( (a<<b) I (a>> (16-b) ) ) 

/* unions: used to remove "endian" issues */ 

typedef union { 

u32 b32; 

ul6 bl6[2] ; 

u8 b8[4]; 
} DWORD; 

typedef union { 

ul6 bl6; 

u8 b8[2]; 
} WORD; 

/* globals: The subkey arrays */ 

static ul6 KLil[8], KLi2[8]; 

static ul6 K0il[8], KOi2[8], KOi3[8]; 

static ul6 KIil[8], KIi2[8], KIi3[8]; 



* FI() 

* The FI function (fig 3). It includes the S7 and S9 tables. 

* Transforms a 16-bit value. 

static ul6 FI ( ul6 in, ul6 subkey ) 
{ 

ul6 nine, seven; 
static ul6 S7 [] = { 

54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18,123, 33, 
55,113, 39,114, 21, 67, 65, 12, 47, 73, 46, 27, 25,111,124, 81, 
53, 9,121, 79, 52, 60, 58, 48,101,127, 40,120,104, 70, 71, 43, 
20,122, 72, 61, 23,109, 13,100, 77, 1, 16, 7, 82, 10,105, 98, 



£75/ 



3GPP TS 35.202 version 5.0.0 Release 5 



21 



ETSI TS 135 202 V5.0.0 (2002-06) 



117,116 


76 


11 


89 


106 


0,125, 


118, 


99, 


86, 


69, 


30, 


57, 


L26, 87, 


112, 51 


17, 5, 


95, 


14, 


90, 84, 91, 


8, 


35,103, 


32, 


97, 28, 66, 


102, 31 


26, 45 


75 


4, 


85, 92, 37, 


74, 


80, 


49, 


68, 


29, 


L15, 44, 


64,107, 


L08, 24, 


110, 


83, 


36, 78, 42, 


19, 


15, 


41, 


88, 


119, 


59, 3}; 


static ul6 S9[] = { 




















167,239 


161,379 


391 


334 


9,338, 38 


226 


48 


358 


452 


385 


90,397 


183,253 


147 


331 


415 


340 


51,362 


306 


500 


262 


82 


216 


159 


356, 177 


175,241 


489 


37 


206 


17 


0,333 


44 


254 


378 


58 


143 


220 


81,400 


95, 3 


315 


245 


54 


235 


218,405 


472 


264 


172 


494 


371 


290 


399, 76 


165,197 


395 


121 


257 


480 


423,212 


240 


28 


462 


176 


406 


507 


288,223 


501,407 


249 


265 


89 


186 


221,428 


164 


74 


440 


196 


458 


421 


350,163 


232,158 


134 


354 


13 


250 


491,142 


191 


69 


193 


425 


152 


227 


366,135 


344,300 


276 


242 


437 


320 


113,278 


11 


243 


87 


317 


36 


93 


496, 27 


487,446 


482 


41 


68 


156 


457, 131 


326 


403 


339 


20 


39 


115 


442, 124 


475,384 


508 


53 


112 


170 


479, 151 


126 


169 


73 


268 


279 


321 


168,364 


363,292 


46 


499 


393 


327 


324, 24 


456 


267 


157 


460 


488 


426 


309,229 


439,506 


208 


271 


349 


401 


434,236 


16 


209 


359 


52 


56 


120 


199,277 


465,416 


252 


287 


246 


6 


83,305 


420 


345 


153 


502 


65 


61 


244,282 


173,222 


418 


67 


386 


368 


261,101 


476 


291 


195 


430 


49 


79 


166,330 


280,383 


373 


128 


382 


408 


155,495 


367 


388 


274 


107 


459 


417 


62,454 


132,225 


203 


316 


234 


14 


301, 91 


503 


286 


424 


211 


347 


307 


140,374 


35,103 


125 


427 


19 


214 


453, 146 


498 


314 


444 


230 


256 


329 


198,285 


50, 116 


78 


410 


10 


205 


510, 171 


231 


45 


139 


467 


29 


86 


505, 32 


72, 26 


342 


150 


313 


490 


431,238 


411 


325 


149 


473 


40 


119 


174,355 


185,233 


389 


71 


448 


273 


372, 55 


110 


178 


322 


12 


469 


392 


369,190 


1,109 


375 


137 


181 


88 


75,308 


260 


484 


98 


272 


370 


275 


412,111 


336,318 


4 


504 


492 


259 


304, 77 


337 


435 


21 


357 


303 


332 


483, 18 


47, 85 


25 


497 


474 


289 


100,269 


296 


478 


270 


106 


31 


104 


433, 84 


414,486 


394 


96 


99 


154 


511,148 


413 


361 


409 


255 


162 


215 


302,201 


266,351 


343 


144 


441 


365 


108,298 


251 


34 


182 


509 


138 


210 


335,133 


311,352 


328 


141 


396 


346 


123,319 


450 


281 


429 


228 


443 


481 


92,404 


485,422 


248 


297 


23 


213 


130,466 


22 


217 


283 


70 


294 


360 


419, 127 


312,377 


7 


468 


194 


2 


117,295 


463 


258 


224 


447 


247 


187 


80,398 


284,353 


105 


390 


299 


471 


470, 184 


57 


200 


348 


63 


204 


188 


33,451 


97, 30 


310 


219 


94 


160 


129,493 


64 


179 


263 


102 


189 


207 


114,402 


438,477 


387 


122 


192 


42 


381, 5 


145 


118 


180 


449 


293 


323 


136,380 


43, 66 


60 


455 


341 


445 


202,432 


8, 


237, 


15, 


376, 


536, 


564, 


59,461} 



/* The sixteen bit input is split into two unequal halves, 
* nine bits and seven bits - as is the subkey 

nine = (ul6) (in>>7); 
seven = (ul6) (in&0x7F) ; 

/* Now run the various operations */ 



nine = (ul6) (S9[nine] 
seven = (ul6) (S7 [seven] ' 

seven ^= (subkey>>9); 
nine ^= (subkey&OxlFF) ; 



seven) ; 

(nine & 0x7F) ) , 



nine = (ul6) (S9[nine] ^ seven); 

seven = (ul6) (S7 [seven] "^ (nine & Ox7F) ) ; 

in = (ul6) ( (seven<<9) + nine) ; 

return ( in ) ; 



FOO 



* The FOO function. 

* Transforms a 32-bit value. Uses <index> to identify the 

* appropriate subkeys to use . 

static u32 FO ( u32 in, int index ) 
( 

ul6 left, right; 

/* Split the input into two 16-bit words */ 

left = (ul6) (in>>16) ; 
right = (ul6) in; 

/* Now apply the same basic transformation three times 
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left '"= KOil [index] ; 

left = FI ( left. Kill [index] ) ; 

left ^= right; 

right ^= K0i2 [index] ; 

right = FI ( right, KIi2 [index] ), 

right ^= left; 

left "= K0i3 [index]; 

left = FI ( left, KIi3 [index] ); 

left ^= right; 

in = (( (u32) right) <<16) +left; 

return ( in ) ; 



FLO 



* The FLO function. 

* Transforms a 32-bit value. Uses <index> to identify the 

* appropriate subkeys to use. 

static u32 FL ( u32 in, int index ) 

ul6 1, r, a, b; 

/* split out the left and right halves */ 

1 = (ul6) (in»16) ; 
r = (ul6) (in) ; 

/* do the FLO operations */ 

a = (ul6) (1 & KLil [index] ) ; 
r ^= R0L16 (a, 1) ; 

b = (ul6) (r I KLi2 [index] ) ; 
1 "= R0L16 (b, 1) ; 

/* put the two halves back together */ 

in = ( ( (u32) 1) <<16) + r; 

return ( in ) ; 



* Kasumi ( ) 

* the Main algorithm (fig 1) . Apply the same pair of operations 

* four times. Transforms the 64-bit input. 

* */ 

void Kasumi ( u8 *data ) 
{ 

u32 left, right, temp; 

DWORD *d; 

int n; 

/* Start by getting the data into two 32-bit words (endian corect) */ 

d = (DWORD*) data; 

left = ( ( (u32)d[0] .b8 [0] ) <<24) + ( ( (u32)d[0] .b8 [1] ) <<16) 
+ (d[0].b8[2]<<8) + (d[0].b8[3]); 

right = ( ( (u32 ) d [ 1 ] . b8 [0 ] ) <<24 ) + ( ( (u32 ) d [ 1 ] . b8 [ 1 ] ) <<16) 
+ (d[l].b8[2]<<8) + (d[l].b8[3]); 
n = 0; 
do{ temp = FL ( left, n ); 

temp = FO ( temp, n++ ) ; 

right ^= temp; 

temp = FO ( right, n ); 

temp = FL ( temp, n++ ) ; 

left ^= temp; 
}while ( n<=7 ) ; 

/* return the correct endian result */ 

d[0].b8[0] = (u8) (left>>24) ; d[l].b8[0] = (u8 ) (right>>24 ) ; 

d[0].b8[l] = (u8) (left>>16) ; d[l].b8[l] = (u8) (right>>16) ; 
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d[0].b8[2] = (u8) (left»8) ; d[l].b8[2] = (u8) (right»8) ; 

d[0].b8[3] = (u8)(left); d[l].b8[3] = (u8) (right ) ; 

} 

/* 

* KeySchedule () 

* Build the key schedule. Most "key" operations use 16-bit 

* subkeys so we build ul6-sized arrays that are "endian" correct. 

* */ 

void KeySchedule ( u8 *k ) 
{ 

static ul6 C[] = { 

0x0123, 0x4567, 0x89AB, OxCDEF, OxFEDC, 0xBA98, 0x7654, 0x3210 } ; 

ul6 key [8] , Kprime[8] ; 

WORD *kl6; 

int n; 

/* Start by ensuring the subkeys are endian correct on a 16-bit basis */ 

kl6 = (WORD *)k; 
for( n=0; n<8; ++n ) 

key[n] = (ul6) ( (kl6 [n] .b8 [0] <<8) + (kl6 [n] .b8 [1] ) ) ; 

/* Now build the K' [] keys */ 

for( n=0; n<8; ++n ) 

Kprime[n] = (ul6)(key[n] " C[n]); 

/* Finally construct the various sub keys */ 

for( n=0; n<8; ++n ) 
{ 

KLil[n] = R0L16 (key [n] , 1) ; 

KLi2[n] = Kprime [ (n+2) &0x7] ; 

KOil[n] = R0L16 (key [ (n+1) &0x7] , 5) ; 

K0i2[n] = R0L16 (key [ (n+5) &0x7] , 8) ; 

K0i3[n] = R0L16 (key [ (n+6) &0x7] , 13) ; 

KIil[n] = Kprime [ (n+4) &0x7] , 

KIi2[n] = Kprime [ (n+3) &0x7] 1 

KIi3[n] = Kprime [ (n+7) S0x7] ; 



end of kasumi 
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